CVE-2026-31589: mm: call ->free_folio() directly in folio_unmap_invalidate()

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-24 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops. Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the only caller outside filemap.c.

Affected products

Linux kernel: from 6.14 before 6.19.14; from 7.0 before 7.0.1 — fixed in 6.19.14, 7.0.1

How to fix

Upgrade to a fixed version: Linux kernel 6.19.14, 7.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31589 or the next vulnerability affects your stack